Wiz finds an AI agent that attacks software vendors

Wiz Research tells that an actor used ARTEX in October 2026 against IT and software vendors. ARTEX is a free tool that lets AI agents test and attack systems. The actor overlaps with Storm-0940, a group name that Microsoft uses. The agent made attacks on the sign-in systems Okta, Entra and Cognito. Wiz tells that most tries did not work.

How it works

A planner agent sets each next step. Worker agents use tools, and all results go into one record for all. First the agent reads the target app. Then it tests sign-in, password recovery and sign-up.

The numbers

• The agent tried more than 60 variants of an incorrect sign-in token in two minutes.
• Password tries came about one second apart, in bursts of 20 to 60 minutes.
• Wiz found more than 15 client software names across the victims.

What is not known

Wiz names no victim. It gives no count of tries that did work. It tells that the actor overlaps with Storm-0940, not that the two are the same.

Insight: One free tool, seen from three sides

CrowdStrike connected ARTEX to bank attacks, Microsoft connected it to the ConnectWise attack, and Wiz sees it hit software vendors. ARTEX reads as one tool that many attacks use, and a vendor sign-in system gives access to all of its customers. This reads as a try to go into many companies through one weak vendor. Your risk includes how safe the sign-in systems of your vendors are.